co33 Privacy Policy — How We Handle Your Personal Data

1 Introduction

1.1 co33 ("we", "us", "the Platform", "co33") operates the online betting and casino platform accessible at https://co33.io. This Privacy Policy describes how co33 collects, processes, stores, shares, and protects the personal data of individuals ("you", "the Player", "the User") who access or use the co33 platform, including persons who browse the website without registering an account.

1.2 This Privacy Policy forms part of the overall agreement between you and co33, alongside the Terms and Conditions and the Responsible Gaming Policy. By creating a co33 account, making a deposit, or otherwise using the co33 platform, you acknowledge that you have read this Privacy Policy and consent to the processing of your personal data as described herein.

1.3 co33 is committed to handling personal data in a manner consistent with internationally recognised data-protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality. Although Bangladesh's primary data-protection legislation continues to evolve, co33 voluntarily aligns its data-handling practices with these internationally accepted standards.

2 Personal Data We Collect

2.1 co33 collects the following categories of personal data depending on the nature of your interaction with the platform:

Data Category	Examples	Required or Optional
Identity Data	Full legal name, date of birth, National ID number, passport number, photograph	Required (KYC)
Contact Data	Mobile phone number, email address, residential address (city and district)	Required (registration)
Financial Data	bKash / Nagad / Rocket account numbers, bank account details, deposit and withdrawal history, transaction amounts in ৳	Required (payments)
Account Data	Username, hashed password, account balance, bonus balance, betting history, game session logs	Required (account operation)
Technical Data	IP address, device type, browser type and version, operating system, screen resolution, time zone (BST/UTC+6)	Automatic (platform access)
Usage Data	Pages visited, games played, time spent per session, click-path data, search queries within the platform	Automatic (platform access)
Communication Data	Support ticket content, live chat transcripts, email correspondence with co33 staff	When you contact us
Marketing Preferences	Opt-in or opt-out status for promotional SMS and email communications	Optional (your choice)

2.2 co33 does not collect any special-category sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data (other than identity photographs required for KYC), health data, or data concerning sexual orientation.

3 How We Collect Your Data

3.1 co33 collects personal data through the following channels:

• Direct submission: Data you provide when completing the registration form, submitting KYC documents, making a deposit or withdrawal request, or contacting our support team.
• Automated collection: Technical and usage data collected automatically when you access the co33 platform via cookies, log files, and analytics tools. See Section 8 (Cookies and Tracking) for full details.
• Third-party verification services: Identity and document verification data returned by our KYC partner services when you submit National ID documents for age and identity verification.
• Payment processors: Transaction confirmation data received from bKash, Nagad, Rocket, Upay, and banking partners when deposits or withdrawals are processed.
• Fraud detection systems: Device fingerprint and behavioural data generated by our anti-fraud and responsible gaming monitoring systems during your platform sessions.

4 Purposes of Processing

4.1 co33 processes your personal data for the following specific and lawful purposes:

• Account creation and management: To register your account, verify your identity, maintain your account profile, and enable you to access all co33 platform features.
• Age verification: To confirm that you are at least 21 years of age before granting access to real-money gambling features, as required by our licensing conditions.
• Payment processing: To process deposits, withdrawals, and bonus credits to and from your co33 account in Bangladeshi Taka (৳) via your selected payment method.
• Fraud prevention and anti-money laundering (AML): To detect, investigate, and prevent fraudulent transactions, collusion, money laundering, and other prohibited activities on the co33 platform.
• Responsible gaming compliance: To monitor betting patterns, implement deposit limits and self-exclusion requests, and identify accounts that may be exhibiting signs of problem gambling.
• Customer support: To respond to your support enquiries, complaints, and dispute submissions promptly and accurately.
• Platform improvement: To analyse usage patterns and technical performance data in order to improve the co33 platform experience for all Bangladesh players.
• Marketing communications: To send promotional offers, bonus notifications, and platform news via SMS or email — but only where you have provided explicit opt-in consent. You may withdraw consent at any time.
• Legal and regulatory compliance: To fulfil obligations imposed by co33's international gaming licence, including record-keeping, audit trails, and cooperation with lawful regulatory or law-enforcement requests.

5 Legal Basis for Processing

5.1 co33 processes personal data under the following lawful bases, applied on a purpose-by-purpose basis:

• Contractual necessity: Processing required to perform the co33 account agreement with you — including registration, payment processing, and account management.
• Legal obligation: Processing required to comply with applicable laws and licensing conditions — including KYC, AML screening, record-keeping, and regulatory reporting.
• Legitimate interests: Processing for fraud detection, platform security, responsible gaming monitoring, and service improvement, where these interests are not overridden by your fundamental privacy rights.
• Consent: Processing for marketing communications and for the placement of non-essential cookies, where your prior, freely given, specific consent has been obtained and recorded.

6 Data Sharing and Disclosure

6.1 co33 does not sell, rent, or trade your personal data to any third party for commercial purposes. co33 may share your personal data with the following categories of third parties, solely to the extent necessary for the stated purpose:

• Identity verification providers: KYC and document verification services used to confirm your age and identity. These providers process only the minimum data necessary for verification and are bound by strict data-processing agreements.
• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, City Bank, BRAC Bank, Islami Bank, Sonali Bank, Visa, and Mastercard — solely for the purpose of processing your financial transactions.
• Fraud detection and AML service providers: Third-party services that assist co33 in detecting suspicious activity, preventing fraud, and fulfilling anti-money-laundering obligations.
• Responsible gaming technology providers: Services that power deposit limit tools, session timers, self-exclusion registries, and problem-gambling detection algorithms.
• IT infrastructure providers: Cloud hosting, database management, and cybersecurity service providers who store or process data on co33's behalf under binding data-processing agreements.
• Regulatory and law-enforcement authorities: Where co33 is legally required or compelled by a court order or regulatory directive to disclose personal data. co33 will, where legally permissible, notify affected account holders of such disclosures.

6.2 In the event that co33's business is acquired, merged, or restructured, player personal data may be transferred to the acquiring or successor entity. co33 will notify affected players of any such transfer and provide a reasonable opportunity to request account closure and data deletion prior to the transfer taking effect.

7 International Data Transfers

7.1 co33 operates under an international gaming licence and may utilise service providers whose servers or processing facilities are located outside Bangladesh. Where personal data is transferred to a jurisdiction that does not provide a level of data protection equivalent to that applied by co33, we ensure that appropriate safeguards are in place — such as contractual data-processing agreements incorporating standard data-protection clauses — prior to any transfer taking place.

7.2 By creating a co33 account and accepting these policies, you acknowledge that your personal data may be processed in jurisdictions outside Bangladesh as described in this section, subject to the safeguards outlined above.

8 Cookies and Tracking Technologies

8.1 co33 uses cookies and similar tracking technologies (including local storage and session storage) to operate the platform, remember your preferences, maintain your login session, and collect anonymised analytics data to improve the platform experience.

8.2 The following categories of cookies are used by co33:

• Strictly necessary cookies: Essential for the platform to function. These cannot be disabled. They include session authentication tokens, load-balancing identifiers, and security cookies.
• Functional cookies: These remember your language and display preferences and improve the usability of the platform. You may disable these via your browser settings, though some platform features may not function correctly as a result.
• Analytics cookies: Used to collect anonymised data about how players use the co33 platform — pages visited, games played, session duration. This data is used exclusively to improve the platform and is never shared for third-party advertising purposes.
• Fraud-prevention and responsible gaming cookies: Used to maintain session continuity for responsible gaming tools, including session timers and deposit limit enforcement. These are essential for regulatory compliance and cannot be disabled.

8.3 co33 does not use third-party advertising cookies or retargeting pixels. Your co33 browsing behaviour is not shared with any external advertising network.

8.4 You may manage cookie preferences through your browser settings. Instructions for managing cookies in commonly used browsers are available in those browsers' official help documentation. Please note that disabling certain cookies may impair the functionality of the co33 platform.

9 Data Retention

9.1 co33 retains personal data for the following periods, after which data is securely deleted or irreversibly anonymised:

• Active account data: Retained for the duration of your co33 account and for a minimum of 5 years following account closure, in compliance with anti-money-laundering record-keeping obligations.
• KYC and identity documents: Retained for 5 years from the date of verification or account closure, whichever is later, as required by co33's licensing conditions.
• Transaction records: Retained for 7 years from the date of the transaction, in accordance with standard financial record-keeping requirements.
• Support and communication records: Retained for 3 years from the date of the final communication in each support thread.
• Technical and usage logs: Retained for 12 months from the date of collection for platform security and fraud investigation purposes, then deleted.
• Marketing consent records: Retained for the duration of your account, and for 2 years following account closure, as evidence of lawful consent to marketing communications.

10 Your Privacy Rights

10.1 As a co33 account holder, you hold the following rights in relation to your personal data. To exercise any of these rights, submit a written request in English to [email protected]. co33 will respond to all verified requests within 30 calendar days.

• Right of access: You may request a copy of all personal data held about you by co33, along with details of how it is processed and with whom it is shared.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data held about you. Name corrections require re-submission of identity documents.
• Right to erasure ("right to be forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to co33's legal retention obligations. co33 cannot delete data that it is legally required to retain.
• Right to restrict processing: You may request that co33 restrict the processing of your data (e.g., while a data accuracy dispute is being resolved) without deleting it.
• Right to data portability: You may request your account and transaction data in a structured, machine-readable format (CSV or JSON) for transfer to another service provider.
• Right to object: You may object to processing based on legitimate interests, or to direct marketing at any time. co33 will cease processing for the contested purpose unless co33 can demonstrate compelling legitimate grounds that override your objection.
• Right to withdraw consent: Where processing is based on your consent (e.g., marketing communications), you may withdraw that consent at any time with immediate effect. Withdrawal of consent does not affect the lawfulness of processing conducted before withdrawal.

11 Children's Privacy

11.1 The co33 platform is strictly for adults aged 21 years and above. co33 does not knowingly collect personal data from any person under the age of 21. If co33 becomes aware that personal data has been collected from an individual under the age of 21, that data will be deleted immediately and the associated account closed without notice.

11.2 If you believe that a person under the age of 21 has registered a co33 account or provided personal data to co33, please notify us immediately at [email protected] so that the matter can be investigated and resolved promptly.

12 Security Measures

12.1 co33 implements a comprehensive set of technical and organisational security measures to protect player personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• 256-bit SSL/TLS encryption for all data in transit between your device and co33 servers.
• AES-256 encryption for sensitive data stored at rest, including identity documents and payment account details.
• Role-based access controls limiting employee access to personal data to those with a verified operational need.
• Two-factor authentication for all co33 administrative systems.
• Regular third-party penetration testing and security audits of the co33 platform infrastructure.
• Intrusion detection and real-time monitoring systems covering all co33 server environments.
• Incident response procedures with defined notification timelines in the event of a confirmed data breach.

12.2 In the event of a data security incident that affects your personal data and poses a material risk to your rights or interests, co33 will notify affected account holders without undue delay and will provide clear guidance on any protective steps you should take.

13 Third-Party Links and Services

13.1 The co33 platform may contain references to third-party payment providers or game software studios (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi). These third-party providers operate under their own privacy policies, which co33 has no control over. co33 is not responsible for the privacy practices of these providers in relation to data they collect directly through their own systems.

13.2 co33 recommends that you review the privacy policies of any third-party service provider whose services you use in conjunction with the co33 platform, particularly your chosen mobile wallet provider (bKash, Nagad, or Rocket), as they will have their own data-processing practices that are independent of co33.

14 Changes to This Privacy Policy

14.1 co33 reserves the right to update this Privacy Policy at any time to reflect changes in our data-processing practices, legal obligations, or platform features. The version number and effective date at the top of this document will be updated with each revision.

14.2 Where a change is material — meaning it significantly affects your rights or the way co33 processes your personal data — co33 will publish a prominent notice on the co33 website homepage and, where practicable, send a notification to your registered mobile number or email address at least 14 days before the change takes effect.

14.3 Your continued use of the co33 platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated policy. If you do not agree with any material change, you may request account closure and data deletion before the revised policy takes effect.

15 Contact and Data Rights Requests

15.1 For any privacy-related enquiry, data rights request, or concern regarding co33's handling of your personal data, please contact our Data Protection team using the details below. All correspondence must be in English. co33 aims to acknowledge receipt of all privacy requests within 1 business day and to resolve them within 30 calendar days.

• Email: [email protected] (plain text — not a clickable link)
• Subject line for data requests: "Privacy Request — [Your Username]"
• Subject line for data deletion: "Data Deletion Request — [Your Username]"
• Subject line for marketing opt-out: "Marketing Opt-Out — [Your Username]"
• Response target: 30 calendar days for verified requests
• Support hours: 24 hours a day, 7 days a week